58d6ed54c25c4dc24293cff5a74f221c19e8d4f1b2be8b21b0fa878c06afde02

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7019e448e1a7da22d2d982f89fcfda9a_JaffaCakes118.html
Size

10KB
MD5

7019e448e1a7da22d2d982f89fcfda9a
SHA1

f9c9d30711410693ad36c10829cf8c89fbbe5e6b
SHA256

58d6ed54c25c4dc24293cff5a74f221c19e8d4f1b2be8b21b0fa878c06afde02
SHA512

f3e71905da6ee04b328000c358cd396f7f41e4cc209c9391cb9eef23445596713dc9e13f197ac071e7808ba6e4a859f1a49f680dbcfcb60c3cef06c1bd481058
SSDEEP

192:2VtlIsr03FrFY8k/w1wvqVkZF+BFWFtnF7FuFSKFnFw013auBuLbdU8d:stlIcupi/gYIBEvn9IMKVC03aguLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
1788	msedge.exe
1788	msedge.exe
4008	identity_helper.exe
4008	identity_helper.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4632	1788	msedge.exe	84
PID 1788 wrote to memory of 4632	1788	msedge.exe	84
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 1280	1788	msedge.exe	85
PID 1788 wrote to memory of 3580	1788	msedge.exe	86
PID 1788 wrote to memory of 3580	1788	msedge.exe	86
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87
PID 1788 wrote to memory of 4472	1788	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7019e448e1a7da22d2d982f89fcfda9a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2e0446f8,0x7ffb2e044708,0x7ffb2e044718
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13306321110434685385,16900557064123340867,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
effaea1dd220c864fef8068b42d64eba

SHA1
e7ed2e2762d3169bc8884ecce7b139cf194811a4

SHA256
8ac7d7dffed5b674614093e4efd5043b261142625f9f1805c2bdd6a3f9bc9467

SHA512
4eb4988bd135d49f17182e2513ed470821fd417373a9a77bfa11c1afd4d3ac9e64e024bcbc24b05a369ad485cc08bd753f7b0c2b14d3053bbfabc04580f5b2e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
16a52dd9d5385a7b5a4f1005e4b59334

SHA1
b5fc0442d69c0ace3e1f088a3d4b43c96f3ac153

SHA256
bb9e41ff8dacf3d3227ba34d3f9528544e4755d2aca2d78a37299dd3017034b8

SHA512
5ffc035d569b18f47522ae68b2beb52e5ec112d4aa8c0121706b00498fa55fc0fb040d2e94f1d20d699e434da111c39b012156c831ec0305a8a2deb5e17178f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90f744c270d71a00f57d73395c3878ec

SHA1
1b393bf80f5bd7fe9dd581227720d0a9b06f6849

SHA256
291fd0582dd69322e262a1b3948e0c64b8a85ed60aeaeefdb5a3e97965cacb0b

SHA512
f45e6051db192aeda5a9cdea18be347d96108c18d8a4812078a69f99f100f0cf423e223cd9dd40fa46079443f2a8198232d9552155736dbbe62f3b6a2674578f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e3c5186d3e454dd803d54a267092877

SHA1
830ea9e40dae24831710645a9a2bf7be406fca70

SHA256
1a4b6813fdb0991f0571ad78d9235b249d3e4fa85211a668080530c6f675aab3

SHA512
d4a5ddc522e65c99f0f6cdbc41fecfe1b5a94122173227740d976c45f9e9b69d34fd7df78316de94f47a8b4bc9f108e9acc36896dbd9c0794e62b14b97969628

Download Submit